Secret watermark labels proteins as ‘made by AI’

An illustration of complex protein structures shown as transparent, ribbon-like coils and folds intertwined with colourful molecular components on a gradient blue background

Proteins (artist’s illustration) designed by AI tools can now incorporate a hidden digital tag revealing their origins. Credit: Christoph Burgstedt/SPL

Proteins designed by artificial intelligence could soon carry a hidden signature of their machine-generated origins, thanks to a watermarking system described today in Nature1.

The technology, developed by researchers at Google DeepMind in London, borrows a trick that is already used to identify AI-made content across images, video, audio and text. It involves weaving a faint statistical tell into both the amino-acid sequence and 3D shape of computer-designed proteins — without noticeably compromising their function.

Known as SynthIDBio, the approach could distinguish AI-generated proteins in biological repositories from their natural counterparts, helping to preserve the integrity of databases that underpin both scientific research and biosecurity screening.

Five protein-design questions that still challenge AI

Steph Guerra, a biosecurity scholar at the non-profit research organization RAND in Washington DC, sees value in an approach that aligns interests across the life-sciences community. Watermarking can support innovation and scientific reproducibility, she says, “and, at the same time, have a security benefit”.

The catch is that this molecular stamp can be scrubbed away. Someone who wants to erase the ‘made by AI’ tag can, in many cases, run a watermarked protein through another design tool and generate a new sequence that retains the protein’s structure and function but obscures its synthetic origins.

It is therefore best viewed as one more tool in a layered framework for guarding against biological threats, says Tessa Alexanian, a biosecurity researcher formerly at the International Biosecurity and Biosafety Initiative for Science, a non-profit organization in Geneva, Switzerland. “We’re in a wild new world,” she says.

Blind spots in biosecurity

Among the potential users of the watermarking system are companies that make DNA sequences to order. Customers then use this DNA to produce their desired proteins.

Such companies routinely check whether a customer’s DNA sequence encodes known toxins, proteins made by pathogens and other concerning molecules. But they could miss a design dreamt up by AI with a protein sequence that bears little or no resemblance to anything in their reference databases, even if the resulting protein performs much the same function once produced and put into a cell.

AI can design viruses, toxins and other bioweapons. How worried should we be?

One solution, outlined by Alexanian and her colleagues, involves screening not only for sequence matches but also for the biological function that a DNA sequence might encode.2–4 That still requires working out what the resulting protein might do, however.

SynthIDBio offers a simpler alternative: it inserts a hidden clue into any AI-designed protein — encoded both at the sequence level, by subtly changing the pattern of amino acid building blocks that comprise the protein, and in the protein’s 3D shape, through tiny changes in how its atoms are arranged.

The watermark would automatically be added to proteins designed by AI tools such as AlphaFold and RFdiffusion. It could be spotted by anyone who held a secret detection key, which would be shared only with trusted partners such as DNA sequence makers.

The watermark could still be useful even though it reveals nothing except that a protein was made using an AI tool. “The synthesis providers I’ve talked to have been kind of like, ‘Any information you can give us to make sense of these orders is good’,” Alexanian says.

Marking without mangling

But that utility is undermined if the watermark interferes with what a protein is designed to do. So, computer scientist Pushmeet Kohli and his team at DeepMind “stress-tested the approach on a number of challenging problems”, he says. They found that the watermarked proteins were able to bind to a range targets — including those involved in viral infection, blood-vessel formation and immune regulation — as efficiently as unwatermarked ones.

Enjoying our latest content?

Access the most recent journalism from Nature's award-winning team
Explore the latest features & opinion covering groundbreaking research

Access through your institution

Continue with Google

Continue with ORCiD

doi: https://doi.org/10.1038/d41586-026-03033-y

Updates & Corrections

Clarification 01 October 2026: This article has been changed to clarify the information that is not provided by SynthIDBio.

References

1. Stutz, D. et al. Nature https://doi.org/10.1038/s41586-026-10965-y (2026). Article Google Scholar 2. Wittmann, B. J. et al. Science 390, 82–87 (2025). Article PubMed Google Scholar 3. Abel, G. R. Jr. et al. Front. Bioeng. Biotechnol. 14, 1832724 (2026). Article PubMed Google Scholar 4. Wittmann, B. J. et al. Front. Bioeng. Biotechnol. 14, 1858951 (2026). Article PubMed Google Scholar 5. Zhang, Z. et al. Preprint at bioRxiv <https://doi.org/10.1101/2024.10.23.619960> (2026). 6. Zhang, Z. et al. Preprint at arXiv <https://doi.org/10.48550/arXiv.2510.15975> (2025).